Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell command lines that attempt to hide the console window by calling ShowWindowAsync from user32.dll while assigning a randomly generated GUID as the window title. This technique is used to evade detection by keeping malicious PowerShell activity invisible to the user, as seen in recent StealC infostealer loader chains.
Detects PowerShell processes executing [Reflection.Assembly]::Load to load .NET assemblies directly into memory. This behavior is commonly used by fileless loaders such as StealC to execute malicious payloads while avoiding disk-based artifacts.
Detects instances of PowerShell executing process injection techniques (such as memory allocation and remote thread creation) targeting specific legitimate processes including csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is indicative of the StealC malware attempting to masquerade its malicious code execution within trusted system or browser processes.
Detects malicious PowerShell activity using the -ExecutionPolicy Bypass flag combined with caret obfuscation or indicators related to known malicious infrastructure used in ClickFix-style social engineering campaigns. The rule specifically monitors for attempts to download or execute configuration.ps1 from identified attacker domains and IP addresses.
Detects execution of PowerShell commands containing suspicious arguments (e.g., encoded commands, download cradles) initiated by scheduled task binaries (svchost.exe, taskeng.exe, schtasks.exe) or involving specific suspicious strings associated with identified threat activity.
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Detects Evil-WinRM / WinRM-fs usage or wsmprovhost.exe-spawned PowerShell tied specifically to bird-agent backdoor artifacts (cplsupport, wtass, config.toml) or encoded/download-cradle command patterns, rather than any WinRM session, reducing noise from routine remote administration.
Detects execution of PowerShell.exe initiated by cplsupport.exe with hidden window styles and non-interactive, no-profile flags, which is often indicative of obfuscated command execution or malicious script activity.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.
Detects the execution of PowerShell commands that utilize base64-encoded strings, window style arguments for obfuscation, and subsequent decoding to reveal suspicious indicators such as network downloading commands or archive manipulation, indicative of potential fileless malware staging.
Detects a suspicious sequence of activities where PowerShell downloads or extracts specific zip files (node.zip, build.zip) to staging directories, followed by the execution of associated binaries like node.exe, winpty-agent.exe, or winpty.dll from those same locations. This behavior is indicative of an adversary staging and executing tooling within temporary user directories.
Detects PEEP Secure Preferences integrity-hash forgery (protection.macs/super_mac) and known PEEP persistence scripts (patch_secure_prefs.ps1, install_silent.ps1, force_enable.ps1), anchored to actual Chrome/Edge profile paths rather than generic terms like 'protection' or 'developer_mode' that appear in unrelated admin tooling.
Detects instances where PowerShell is used to download an executable named 'svchost.exe' from an external IP address (103.86.86.244). The rule monitors for network connections to this IP, file creation events matching specific download patterns in fonts directories, and direct command-line arguments involving the suspicious IP and file path, indicating potential malware dropper activity.
This rule detects the execution of powershell.exe with command-line arguments that utilize 'curl' to download a file from a specific remote IP address (103.86.86.244). This behavior is characteristic of adversaries using built-in Windows tools or redirected utilities to perform ingress tool transfer as part of a malicious payload delivery.
This rule detects suspicious PowerShell execution that attempts to download files from the internet using the Invoke-WebRequest cmdlet. It specifically looks for PowerShell processes launched with hidden and execution policy bypass flags, coupled with specific hardcoded malicious URL patterns associated with a known campaign (NotaFiscal/nfe_valid_access_key_2026_secure).
This rule detects the use of PowerShell to modify Microsoft Defender settings to disable real-time, behavior, and IOAV protection, while simultaneously adding a full-drive exclusion for the root directory (C:\). This behavior is characteristic of an adversary attempting to disable security monitoring to facilitate further malicious activity or avoid detection.
Detects the execution of AADInternals PowerShell toolkit commands. AADInternals is a known framework used for administration, enumeration, and exploitation of Azure Active Directory and Microsoft Entra ID, including the creation of backdoors and manipulation of federation settings.
Detects PowerShell command execution that uses bitwise XOR operations combined with the .NET [IO.File]::WriteAllBytes method. This pattern is commonly used by malware, such as AsyncRAT, to deobfuscate and drop secondary payloads or modules onto the file system during execution.
This rule detects PowerShell processes spawned directly or indirectly by LNK files that include command-line arguments indicative of anti-analysis, anti-VM, or reconnaissance techniques. These include querying for specific WMI classes (e.g., Win32_Process, Win32_ComputerSystem), checking for virtualization artifacts (e.g., 'virtualbox', 'vmware', 'qemu', 'sandboxie'), or querying security and hardware information (e.g., 'antivirusproduct', 'securitycenter2', 'getmac').
Detects the use of .NET reflection methods (such as Assembly.Load or LoadFrom) within command-line arguments of processes frequently abused for secondary execution (e.g., rundll32.exe, regsvr32.exe) when initiated by common scripting or execution engines like PowerShell, cmd.exe, or mshta.exe. This pattern is indicative of fileless malware execution or reflective assembly loading commonly used to bypass traditional signature-based detection.
Detects the execution of PowerShell with suspicious command line flags (such as hidden windows, bypass execution policies, or encoded commands) where the parent process is a shortcut (.lnk) file. This is a common technique used by attackers to execute malicious scripts via phishing or social engineering, where a user is tricked into clicking a malicious link file.
Page 42 of 160